CVE-2024-47084 CORS origin validation is not performed when the request has a cookie in Gradio

Medium 6.9 Published 10 Oct 2024 Updated 11 Oct 2024

Exploited in the wild: Not known
Fix: Available

What is CVE-2024-47084?

CVE-2024-47084 is a medium-severity vulnerability in Gradio Project Gradio, published on 10 Oct 2024.

Official description

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio server. Potentially, attackers can upload files, steal authentication tokens, and access user data if the victim visits a malicious website while logged into Gradio. This impacts users who have deployed Gradio locally and use basic authentication. Users are advised to upgrade to `gradio>4.44` to address this issue. As a workaround, users can manually enforce stricter CORS origin validation by modifying the `CustomCORSMiddleware` class in their local Gradio server code. Specifically, they can bypass the condition that skips CORS validation for requests containing cookies to prevent potential exploitation.

Weakness: CWE-285

Which versions are affected by CVE-2024-47084?

3 open source packages ship an affected version, including gradio. It affects 1 product.

Package	Affected	Fixed in
`gradio` PyPI	All versions	`4.44.0`
`gradio` PyPI	All versions	`4.44.0`
`gradio` PyPI	All versions	`4.44.0`

Products include Gradio Project Gradio.

How do I fix CVE-2024-47084?

Upgrade gradio to 4.44.0 or later.

Is CVE-2024-47084 being exploited?

There is no known exploitation of CVE-2024-47084 in the wild and no public exploit code.

All Gradio Project Gradio vulnerabilities

Sources

Also known as GHSA-3c67-5hwx-f6wx, PYSEC-2024-196.